Professional Secrecy in the Digital Era

A Problem Almost No One Sees

A lawyer receives a sensitive document from a client on their phone. A doctor discusses a delicate diagnosis with a colleague, while a psychologist coordinates a patient's treatment with a psychiatrist. And a tax advisor sends data for a pending tax return through the same channel. They all do this via instant messaging. And hardly anyone stops to consider where those messages actually end up.

The answer, in most cases, is the same: on a server the professional does not control, in a country whose legislation they do not necessarily know, managed by a company whose business model is, in direct economic terms, data accumulation. The message may be encrypted in transit. But once it reaches the server, it is a copy stored on a third party's infrastructure, subject to the operational, legal, and commercial decisions of that third party. Not the professional's.

What Legislation Says

The European General Data Protection Regulation is unequivocal in its Article 32: whoever processes personal data must apply "appropriate" technical and organizational measures to ensure a level of security appropriate to the risk. The adequacy of measures is not evaluated against "what the app says it does," but against the real risk. If a client's data ends up on a server whose jurisdiction does not guarantee a level of protection equivalent to that of the European Economic Area, the controller—that is, the professional—is assuming a risk they are probably not fully aware of.

And it's not just the GDPR. Professional secrecy, specifically regulated for lawyers, doctors, psychologists, auditors, journalists, and others, requires that communication with the client be confidential. Not "confidencial to the extent possible." Confidential without qualifiers. If the technical channel used cannot guarantee it, the professional is assuming a risk that their profession's ethics do not allow.

The paradox is that the risk is invisible. No one audits the law firm's messaging. No one asks for the data processing contract from the chat provider. The risk emerges only when it's too late: a leak, a published breach, a court order fulfilled on another continent without user notification.

What a Professional Technically Needs

What a professional bound by professional secrecy needs is, in reality, surprisingly simple from a requirements standpoint:

• A channel where messages go directly from the sender's device to the receiver's, without passing through an intermediate server that stores copies.
• An infrastructure whose jurisdiction and policies are aligned with the GDPR by construction, not by declaration.
• A way to identify oneself to the interlocutor without having to hand over professional contacts to a third party (client names, phone numbers, address book).
• Some verifiable system—not based on the provider's word—to confirm that the message reached the correct person.

It is not a demanding list. It is, in fact, what was taken for granted in pre-digital professional communication. A certified letter met all those criteria. A telephone call from the firm's switchboard to the client's also did. What is strange is not that these guarantees are requested today: what is strange is that they have been lost when moving to the digital channel, without anyone noticing.

The Difference Between Encrypting and Not Storing

There is a useful metaphor. Encrypting a message and storing it on a server is equivalent to putting a document in a safe and leaving the safe in a stranger's house. The safe is good. The document, in principle, cannot be read. But the document remains in someone else's house. And that someone else can receive a court order, can suffer a cyberattack, can change their terms of service, can be bought by another company with different ethics, can disappear tomorrow.

The structural alternative, which is neither procedural nor trust-based, is that the document never leaves the firm. That it travels directly from the professional's desk to the client's desk, without passing through any intermediary. That is exactly what point-to-point communication between devices does technically: it eliminates the intermediary. The intermediary is not inherently malicious: for the purposes of professional secrecy, it is simply unnecessary. And what is unnecessary, in any system that aspires to be secure, must be eliminated on principle.

The Question of Responsibility

In the end, the question that every professional with a duty of secrecy should be able to answer with a resounding yes is the following:

If tomorrow a conversation with one of my clients is leaked and a court or a professional association asks me how I manage confidentiality, can I technically demonstrate that the channel I used does not store copies on third-party infrastructure? Can I prove that the data never left the devices of the two people who participated in the conversation? Can I demonstrate, without depending on the word of a company from another continent, that confidentiality was guaranteed by architecture and not by a promise?

If the answer is no, it is not a problem with the specific tool: it is that a responsibility has been delegated to it for which it was not designed. It is akin to placing confidential files in a transparent envelope and trusting that the postman will not look.

The tool a professional chooses to communicate with their clients says a lot about how they value their trust. There are tools designed so that trust does not depend on promises, but on architecture. And there are tools that are not. Knowing the difference is part of the job.